Fetch Tokens

Fetch tokens unlock private /r/{slug} bytes. They are not API tokens and they are not session cookies.

How to send

Created when a script becomes private. Shown once. Stored as a SHA-256 hash. Send Authorization: Bearer on /r/{slug}. Query token is accepted on that path only.

API tokens starting with rny_ do not unlock private scripts. Fetch tokens do not call /api/v1.

Rotate

Rotate from the share page. The previous token stops matching immediately. Switching a script away from private clears the hash.